The Linux distros have gone bat-shit crazy with their security garbage.
For example, all distros now are built with PIE, or Position Independent
Executables, and RELRO (Relocation Read-Only).

This cuts performance considerably especially when heaped upon all the
security junk.

The distros have the chicken-little "the sky is falling" philosophy.

What insane idiocy.

To check what kind of security is crippling your software one can use
the "checksec" utility:

https://github.com/slimm609/checksec.sh

Here are the results from a check of MY pan executable:

checksec --file=/usr/local/bin/pan

RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No Symbols No 0 12 /usr/local/bin/pan

Now that's how it's supposed to be! I say "Fuck You!" to that
security nonsense.

There is no RELRO, no canary (i.e. stack protection), no PIE, and no for
every-fucking-thing else.

The exception is "NX," but this is purely a hardware feature in the
BIOS.

Compare this your distro "hardened" junk.

The distros have gone insane with their "the sky is falling"
philosophy.

--
Systemd: solving all the problems that you never knew you had.

On 2024-09-16, Lester Thorpe <lt@gnu.rocks> wrote:
> The Linux distros have gone bat-shit crazy with their security garbage.
> For example, all distros now are built with PIE, or Position Independent
> Executables, and RELRO (Relocation Read-Only).
>
> This cuts performance considerably especially when heaped upon all the
> security junk.
>
> The distros have the chicken-little "the sky is falling" philosophy.
>
> What insane idiocy.
>
> To check what kind of security is crippling your software one can use
> the "checksec" utility:
>
> https://github.com/slimm609/checksec.sh
>
> Here are the results from a check of MY pan executable:
>
> checksec --file=/usr/local/bin/pan
>
> RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
> No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No Symbols No 0 12 /usr/local/bin/pan
>
> Now that's how it's supposed to be! I say "Fuck You!" to that
> security nonsense.
>
> There is no RELRO, no canary (i.e. stack protection), no PIE, and no for
> every-fucking-thing else.
>
> The exception is "NX," but this is purely a hardware feature in the
> BIOS.
>
> Compare this your distro "hardened" junk.
>
> The distros have gone insane with their "the sky is falling"
> philosophy.
>
>

What sort of performance penalty do these security measures inflict?

I have noticed a change in my Debian 12 installation, where some
assembly programs I wrote require PIE disabled before they will link
using gcc. Is that related?

On Tue, 17 Sep 2024 13:19:41 -0000 (UTC), Borax Man wrote:

>
> What sort of performance penalty do these security measures inflict?
>

It depends. But for any particular security feature the degradation is
measurable and is usually about 1%-5% and maybe more.

The problem is that there are hundreds of these security features and
when added together the performance impact may be quite significant.

Note that the kernel source file "kernel-parameters.txt" explicitly states
this:

mitigations = off
Disable all optional CPU mitigations. This
improves system performance...

There are no measures but it is a good indication of how various security
features can add up to significantly degrade performance.

IMO, a desktop workstation requires no security whatsoever but the distros
seem to assume that every GNU/Linux installation is a public-facing server.

I have created my own benchmarks that show performance increase with single
threaded math application of 37% with optimized programs versus distro programs.

>
> I have noticed a change in my Debian 12 installation, where some
> assembly programs I wrote require PIE disabled before they will link
> using gcc. Is that related?
>

Most likely it is. A PIE executable has no absolute addresses but only
relative addresses and these need to be handled differently by the loader.

--
Systemd: solving all the problems that you never knew you had.

On 9/16/24 4:05 PM, Lester Thorpe wrote:
> The Linux distros have gone bat-shit crazy with their security garbage.
> For example, all distros now are built with PIE, or Position Independent
> Executables, and RELRO (Relocation Read-Only).
>
> This cuts performance considerably especially when heaped upon all the
> security junk.
>
> The distros have the chicken-little "the sky is falling" philosophy.
>
> What insane idiocy.
>
> To check what kind of security is crippling your software one can use
> the "checksec" utility:
>
> https://github.com/slimm609/checksec.sh
>
> Here are the results from a check of MY pan executable:
>
> checksec --file=/usr/local/bin/pan
>
> RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
> No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH No Symbols No 0 12 /usr/local/bin/pan
>
> Now that's how it's supposed to be! I say "Fuck You!" to that
> security nonsense.
>
> There is no RELRO, no canary (i.e. stack protection), no PIE, and no for
> every-fucking-thing else.
>
> The exception is "NX," but this is purely a hardware feature in the
> BIOS.
>
> Compare this your distro "hardened" junk.
>
> The distros have gone insane with their "the sky is falling"
> philosophy.

Well, THESE days, IS it all "insane" ???

Sorry, but State-funded evil people are
plentiful. MAY have to sacrifice some
performance for security.

Just sayin'

On Wed, 18 Sep 2024 02:43:59 -0400, 186282@ud0s4.net wrote:

>
> Well, THESE days, IS it all "insane" ???
>
> Sorry, but State-funded evil people are
> plentiful. MAY have to sacrifice some
> performance for security.
>

GNU/Linux is most popular for public-facing servers with
lots of virtual machines. In this case, security is essential.

However, on a personal desktop workstation, with no open
network ports (save the occasional HTTP/HTTPS), then security
is quite unnecessary and should be eliminated.

I can guarantee that no state actor, or any other entity,
is interested in cracking my machine.

Most distros are built for the server role and they will
include tons of security features. Check out Ubuntu which
is the state of the art:

https://wiki.ubuntu.com/Security/Features

This list will only keep growing over time.

--
Systemd: solving all the problems that you never knew you had.

On 9/17/2024 4:02 PM, Lying Larry Pietraskiewicz wrote:

> I have created my own benchmarks

You plagiarized from SciMark. You're a fraud.

Le 17-09-2024, Borax Man <rotflol2@hotmail.com> a écrit :
> On 2024-09-16, Lester Thorpe <lt@gnu.rocks> wrote:
>>
>> This cuts performance considerably especially when heaped upon all the
>> security junk.
>
> What sort of performance penalty do these security measures inflict?

When someone will use his computer to mine bitcoins, the performance
penalties will be far higher than the security on his system. But he
wouldn't be able to spot the difference.

And when someone will use his computer to attack banks/companies
computers at least, the police will know easily that his computer has
been hacked because he can't be the brain of an attack.

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io